Home

CVE-2017-1000112

Description

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ([IPv4/IPv6]: UFO Scatter-gather approach) on Oct 18 2005.

Risk Information

Base Score
7.0
MODERATE
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
83.696

Associated Vulnerability

VulnerabilityOS Platform
Linux kernel (USN-3377-1) linux-image-generic_4.10.0.32.32_i386.debLinux
Linux kernel (USN-3377-1) linux-image-generic_4.10.0.32.32_amd64.debLinux
Linux kernel (USN-3377-1) linux-image-lowlatency_4.10.0.32.32_i386.debLinux
Linux kernel (USN-3377-1) linux-image-lowlatency_4.10.0.32.32_amd64.debLinux
Linux hardware enablement (HWE) kernel (USN-3377-2) linux-image-generic-hwe-16.04_4.10.0.32.34_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3377-2) linux-image-generic-hwe-16.04_4.10.0.32.34_amd64.debLinux
Linux hardware enablement (HWE) kernel (USN-3377-2) linux-image-lowlatency-hwe-16.04_4.10.0.32.34_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3377-2) linux-image-lowlatency-hwe-16.04_4.10.0.32.34_amd64.debLinux
Linux kernel (USN-3384-1) linux-image-generic_4.10.0.32.32_i386.debLinux
Linux kernel (USN-3384-1) linux-image-generic_4.10.0.32.32_amd64.debLinux
Linux kernel (USN-3384-1) linux-image-lowlatency_4.10.0.32.32_i386.debLinux
Linux kernel (USN-3384-1) linux-image-lowlatency_4.10.0.32.32_amd64.debLinux
Linux kernel (USN-3384-1) linux-image-4.10.0-32-generic_4.10.0-32.36_i386.debLinux
Linux kernel (USN-3384-1) linux-image-4.10.0-32-generic_4.10.0-32.36_amd64.debLinux
Linux kernel (USN-3384-1) linux-image-4.10.0-32-lowlatency_4.10.0-32.36_i386.debLinux
Linux kernel (USN-3384-1) linux-image-4.10.0-32-lowlatency_4.10.0-32.36_amd64.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-4.10.0-32-generic_4.10.0-32.36~16.04.1_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-4.10.0-32-generic_4.10.0-32.36~16.04.1_amd64.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-generic-hwe-16.04_4.10.0.32.34_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-generic-hwe-16.04_4.10.0.32.34_amd64.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-4.10.0-32-lowlatency_4.10.0-32.36~16.04.1_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-4.10.0-32-lowlatency_4.10.0-32.36~16.04.1_amd64.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-lowlatency-hwe-16.04_4.10.0.32.34_i386.debLinux
Linux hardware enablement (HWE) kernel (USN-3384-2) linux-image-lowlatency-hwe-16.04_4.10.0.32.34_amd64.debLinux
Linux kernel (USN-3385-1) linux-image-4.4.0-1026-gke_4.4.0-1026.26_amd64.debLinux
Linux kernel (USN-3385-1) linux-image-4.4.0-1030-aws_4.4.0-1030.39_amd64.debLinux
Linux kernel (USN-3385-1) linux-image-4.4.0-91-generic_4.4.0-91.114_i386.debLinux
Linux kernel (USN-3385-1) linux-image-4.4.0-91-generic_4.4.0-91.114_amd64.debLinux
Linux kernel (USN-3385-1) linux-image-4.4.0-91-lowlatency_4.4.0-91.114_i386.debLinux
Linux kernel (USN-3385-1) linux-image-4.4.0-91-lowlatency_4.4.0-91.114_amd64.debLinux
Linux hardware enablement kernel from Xenial for Trusty (USN-3385-2) linux-image-4.4.0-91-generic_4.4.0-91.114~14.04.1_i386.debLinux
Linux hardware enablement kernel from Xenial for Trusty (USN-3385-2) linux-image-4.4.0-91-generic_4.4.0-91.114~14.04.1_amd64.debLinux
Linux hardware enablement kernel from Xenial for Trusty (USN-3385-2) linux-image-4.4.0-91-lowlatency_4.4.0-91.114~14.04.1_i386.debLinux
Linux hardware enablement kernel from Xenial for Trusty (USN-3385-2) linux-image-4.4.0-91-lowlatency_4.4.0-91.114~14.04.1_amd64.debLinux
Linux kernel (USN-3386-1) linux-image-generic_3.13.0.128.137_amd64.debLinux
Linux kernel (USN-3386-1) linux-image-lowlatency_3.13.0.128.137_amd64.debLinux
Linux kernel (USN-3386-1) linux-image-3.13.0-128-generic_3.13.0-128.177_i386.debLinux
Linux kernel (USN-3386-1) linux-image-3.13.0-128-generic_3.13.0-128.177_amd64.debLinux
Linux kernel (USN-3386-1) linux-image-3.13.0-128-lowlatency_3.13.0-128.177_i386.debLinux
Linux kernel (USN-3386-1) linux-image-3.13.0-128-lowlatency_3.13.0-128.177_amd64.debLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-2.6.18-438.el5.x86_64.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-PAE-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-PAE-devel-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-debug-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-debug-2.6.18-438.el5.x86_64.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-debug-devel-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-debug-devel-2.6.18-438.el5.x86_64.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-devel-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-devel-2.6.18-438.el5.x86_64.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-doc-2.6.18-438.el5.noarch.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-headers-2.6.18-438.el5.i386.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-headers-2.6.18-438.el5.x86_64.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-xen-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-xen-2.6.18-438.el5.x86_64.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-xen-devel-2.6.18-438.el5.i686.rpmLinux
(RHSA-2019:1931) kernel security and bug fix update kernel-xen-devel-2.6.18-438.el5.x86_64.rpmLinux
Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) Vulnerability (CVE-2017-1000112)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234